---
typeId: req
recordId: benac-enc-019
fields:
  title: Encryption failure fail-closed
  statement: Benac shall fail closed when required keys, recipient identities,
    encryption metadata, decryption integrity checks, lease bindings, or
    data-class policies are invalid, missing, conflicted, or revoked.
  rationale: Ambiguity shall not create plaintext access.
  verification: Missing recipient key or invalid envelope denies decryption/use.
  testable: true
  status: draft
  area: BENAC-ENC
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.6 Encryption, decryption, and disclosure control
  order: 73
---
